Re: [pkix] Considerations about the need to resume PKIX work

[Anders Rundgren <[e-mail]>]

On 2017-07-20 18:39, Dr. Pala wrote:
> Thanks Anders,
> 
> DISCLAIMER: I just want to clarify that this discussion is not part of what I proposed as work on revocation.
> 
> This said, I would say that if your attempt to provide a decentralized system for payments would benefit from the work around revocation and / or discoverability, I would be interested to read about the use-cases there.

Hi Max,
The system I'm working with is fairly unconventional and maybe not in your taste.  If you take a peek at the link I provided (and associated documents), you will find a "Pseudo CA" issuing short-lived certificate-like objects expressed in JSON.
Why "Pseudo CA"?  Because a true X.509 solution would not meet the decentralization objectives.  Since the payment messages were based on JSON and use the definitions in the certificate-like objects, it seemed logical to use JSON everywhere it was possible.

IoT is an entirely different animal than payments (although some IoT devices can be payers as well).

PKI for user auth was severely wounded by the [not so] smart card industry.  The final kill was made by Google who removed on-line provisioning from Chrome. Not even the inventor of the Web, Sir Berners-Lee could save it:
https://lists.w3.org/Archives/Public/www-tag/2015Sep/0000.html

Cheers,
Anders

> 
> Thanks,
> Max
> 
> 
> On 7/20/17 5:53 PM, Anders Rundgren wrote:
>> On 2017-07-20 14:24, Dr. Pala wrote:
>>> Hi Anders,
>>
>> Hi Max,
>>
>>>
>>> Maybe, this time we might have a way in. I would be willing to work on it (even outside IETF, if there is no interest) and provide implementations in LibPKI. Easy and Secure "Provisioning / Enrollment" protocols are at the core for many ecosystems (e.g., IoT, WIFI, etc.). For the TEEP - I do not think they are going to address this particular issue/issues for what I have seen at the BoF.
>>>
>>> Let's talk about this - can you send me pointers you might think are useful to start from ?
>>
>> Oh, there are virtually TONs of possible and potentially useful crypto-related projects out there.
>>
>> I have over the years provided plenty of pointers in PKIX to such with quite limited feedback.
>> The crux is getting anything implemented as well as getting some kind of funding.
>>
>> There are more subtle hurdles as well.  If you are not world-renowned cryptographer or
>> working for a well-known (US) technology provider nobody will even read your papers.
>>
>> I do currently not work with IoT or WiFi authentication so I may be a less useful partner.
>>
>> I'm rather trying to create a scheme for challenging CENTRALIZED payment schemes
>> like Android and Apple Pay through a DECENTRALIZED trust infrastructure.
>> https://mobilepki.org/webpay-acquirer/payees/86344
>> It is so full of crypto that hardly any bank-tech folks get it :-|
> 
> -- 
> Best Regards,
> Massimiliano Pala, Ph.D.
> OpenCA Labs Director
> OpenCA Logo